IN THE CLAIMS: 



The following is a current listing of claims and will replace all prior versions and listings 
of claims in the application. Please amend the claims as follows: 

1 . (Currently Amended) A method performed by an information handling system, the 
method comprising: 

determining making a determination of the likelihood whether a that a first resource 
received from a first computer network is likely misrepresented as being from a trusted resource 
coupled to the first within a global computer network. 

2. (Currently Amended) The method of claim 1 , wherein the first resource is a web page, 
and is likely misrepresented by [[a]] content of [[a]] the web page. 

3. (Original) The method of claim 2, wherein the content is an information entry field 
embedded in the web page. 

4. (Original) The method of claim 2, wherein the web page is a first web page, and wherein 
the content is an address of a second web page. 

5. (Original) The method of claim 4, wherein the address is a hyperlink embedded in the 
first web page. 

6. (Currently Amended) The method of claim 1 , wherein the first resource is an electronic 
message, and is likely misrepresented by [[a]] content of [[an]] the electronic message. 

7. (Original) The method of claim 6, wherein the content is an information entry field 
embedded in the electronic message. 

8. (Original) The method of claim 6, wherein the content is an address of a web page. 

9. (Original) The method of claim 8, wherein the address is a hyperlink embedded in the 
electronic message. 
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10. (Original) The method of claim 6, wherein the content is a source address of the 
electronic message. 



1 1 . (Currently Amended) The method of claim 1, wherein the first resource is a web page. 

12. (Currently Amended) The method of claim 1 1 , wherein said making a determination 

comprises : 

analyzing an address of the web page. 

13. (Currently Amended) The method of claim 12, wherein the analyzing comprises: 

in response to determining that the address points to a known trusted web page, 
determining making a determination that the web page is not misrepresented as being from a 
trusted resource. 

14. (Currently Amended) The method of claim 12, wherein the analyzing comprises: 

in response to determining that the address points to a known mistrusted web page, 
d e t e rmining making a determination that the web page is likely misrepresented as being from a 
trusted resource. 

15. (Currently Amended) The method of claim 1 1 , wherein said making a determination 
includes d 
comprises : 

analyzing [[a]] content of the web page. 



16. 



(Currently Amended) The method of claim 15, wherein the analyzing comprises: 



in response to determining that the content includes [[a]] predetermined content, making 
a determination determining that the web page is likely misrepresented as being from a trusted 
resource. 



17. (Original) The method of claim 16, wherein the predetermined content is a request for 
financial information. 
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18. (Original) The method of claim 17, wherein the financial information is information 
about a bank account. 

19. (Original) The method of claim 17, wherein the financial information is information 
about a credit card account. 

20. (Currently Amended) The method of claim 1 1 , wherein said making a determination 

comprises : 

analyzing a layout of the web page. 

21 . (Currently Amended) The method of claim 20, wherein the analyzing comprises: 

in response to determining that the layout is similar to a layout of a known mistrusted 
web page, making a determination determining that the web page is likely misrepresented as 
being from a trusted resource. 

22. (Currently Amended) The method of claim 1 1 , wherein said making a determination 
includes d e t e rmining wh e th e r th e r e source is likely misrepresented as a trusted r e sourc e 
comprises : 

analyzing information associated with the web page. 

23. (Original) The method of claim 22, wherein the web page is part of a website, and 
wherein analyzing the information comprises: 

determining an age of the website. 

24. (Original) The method of claim 22, wherein the web page is part of a website, and 
wherein analyzing the information comprises: 

determining a size of the website. 

25. (Currently Amended) The method of claim 22, wherein the web page is part of a website, 
and wherein analyzing the information comprises: 

determining a number of hyperlinks to the website by a known trusted resources. 
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26. (Currently Amended) The method of claim 1 1 , wherein said making a determination 
includes determining whether the resource is likely misrepresented as a trusted resource 

outputting a signal to a computing system that hosts the web page, and analyzing the 
computing system's response thereto. 

27. (Currently Amended) The method of claim 1 1 , wherein said making a determination 
includes determining whether the resource is likely misrepresented as a trusted resource 

performing at least two of the following first set of operations: 
analyzing an address of the web page; 
analyzing [[a]] content of the web page; 
analyzing a layout of the web page; 
analyzing information associated with the web page; and 

outputting information to a computing system hosting the web page and analyzing 
the web page's computing system's response thereto; and 

in response to the performed first set of operations, determining a score indicative of the 
likelihood that whether the first resource is likely misrepresented as being from a trusted 
resource. 

28. (Currently Amended) The method of claim 27, wherein the performing comprises 
performing at least three of the first set of operations. 

29. (Currently Amended) The method of claim 27, wherein the performing comprises 
performing at least four of the first set of operations. 

30. (Currently Amended) The method of claim 27, wherein the performing comprises 
performing at least five of the first set of operations. 

3 1 . (Currently Amended) A system, comprising: 
one or more processors; 
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memory storing program instructions executable by the one or more processors to: 

an information handling system for make a determin ation ing whether that a first resource 
received from a first computer network is likely misrepresented as being from a trusted resource 
coupled to the first within a global computer network. 

32. (Currently Amended) The system of claim 3 1 , wherein the first resource is a web page, 
and is likely misrepresented by [[a]] content of [[a]] the web page. 

33. (Original) The system of claim 32, wherein the content is an information entry field 
embedded in the web page. 

34. (Original) The system of claim 32, wherein the web page is a first web page, and wherein 
the content is an address of a second web page. 

35. (Original) The system of claim 34, wherein the address is a hyperlink embedded in the 
first web page. 

36. (Currently Amended) The system of claim 3 1 , wherein the first resource is an electronic 
message, and is lik e ly misrepresented by [[a]] content of [[an]] the electronic message. 

37. (Original) The system of claim 36, wherein the content is an information entry field 
embedded in the electronic message. 

38. (Original) The system of claim 36, wherein the content is an address of a web page. 

39. (Original) The system of claim 38, wherein the address is a hyperlink embedded in the 
electronic message. 

40. (Original) The system of claim 36, wherein the content is a source address of the 
electronic message. 

4 1 . (Currently Amended) The system of claim 3 1 , wherein the first resource is a web page. 
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42 . (Currently Amended) The system of claim 4 1 , wherein making said determination 
includes the information handling system is for determining whether the resource is likely 
misrepresented as a trusted resource by at least : 

analyzing an address of the web page. 

43 . (Currently Amended) The system of claim 42, wherein the information handling system 
is for analyzing an address of the web page includes by at least : 

in response to determining that the address points to a known trusted web page, 
determining making a determination that the web page is not misrepresented as being from a 
trusted resource. 

44. (Currently Amended) The system of claim 42, wherein the information handling system 
is for analyzing an address of the web page includes by at least : 

in response to determining that the address points to a known mistrusted web page, 
d e t e rmining making a determination that the web page is likely misrepresented as being from a 
trusted resource. 

45. (Currently Amended) The system of claim 4 1 , wherein making said determination 
includes the information handling system is for dotormining whether the resource - is likely 
misrepresented as a trusted resource by at least : 

analyzing [[a]] content of the web page. 

46. (Currently Amended) The system of claim 45, wherein the information handling system 
is for analyzing a content of the web page includes by at least : 

in response to determining that the content includes [[a]] predetermined content, making 
a determination determining that the web page is likely misrepresented as being from a trusted 
resource. 

47. (Original) The system of claim 46, wherein the predetermined content is a request for 
financial information. 
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48. (Original) The system of claim 47, wherein the financial information is information about 
a bank account. 



49. (Original) The system of claim 47, wherein the financial information is information about 
a credit card account. 

50. (Currently Amended) The system of claim 41, wherein making said determination 



analyzing a layout of the web page. 

5 1 . (Currently Amended) The system of claim 50, wherein the information handling system 
is for analyzing a layout of the web page includes by at least : 

in response to determining that the layout is similar to a layout of a known mistrusted 
web page, making a determination determining that the web page is likely misrepresented as 
being from a trusted resource. 

52. (Currently Amended) The system of claim 4 1 , wherein making said determination 
includes the information handling system is for determining whether the resource - i3 likely 
misrepresented as a trusted resource by at least : 

analyzing information associated with the web page. 

53. (Currently Amended) The system of claim 52, wherein the web page is part of a website, 
and wherein the information handling system is for analyzing information associated with the 
web page includes by at least : 

determining an age of the website. 

54. (Currently Amended) The system of claim 52, wherein the web page is part of a website, 
and wherein the information handling system is for analyzing information associated with the 
web page includes by at least : 

determining a size of the website. 



includes 




misrepresented 



trusted 



by at least : 
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55. (Currently Amended) The system of claim 52, wherein the web page is part of a website, 
and wherein the information handling system is for analyzing information associated with the 
web page includes by at least : 

determining a number of hyperlinks to the website by a known trusted resources. 

56. (Currently Amended) The system of claim 4 1 , wherein making said determination 
includes the information handling system is for determining whether the resource is likely 
misrepresented as a trusted resource by at least : 

outputting a signal to a computing system that hosts the web page, and analyzing the 
computing system's response thereto. 

57. (Currently Amended) The system of claim 4 1 , wherein making said determination 
includes t he information handling system is for determining whether the resource is likely 
misrepresented as a trusted resource by at least : 

performing at least two of the following first set of operations: 

analyzing an address of the web page; 

analyzing a content of the web page; 

analyzing a layout of the web page; 

analyzing information associated with the web page; and 

outputting information to a computing system hosting the web page and analyzing 
the web page's computing system's response thereto; and 

in response to the performed first set of operations, determining a score indicative of the 
likelihood that whether the first resource is likely misrepresented as being from a trusted 
resource. 

58. (Currently Amended) The system of claim 57, wherein making said determination 
includes the information handling system is for determining whether the resource is likely 
misrepresented as a trusted resource by performing at least three of the first set of operations. 
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59. (Currently Amended) The system of claim 57, wherein making said determination 
includes the information handling system is for determining whether the resource is likely 
misrepresented as a trusted resource by performing at least four of the first set of operations. 

60. (Currently Amended) The system of claim 57, wherein making said determination 

misrepresented as a trusted resource by performing at least five of the first set of operations. 

6 1 . (Currently Amended) A compute r-readable memory medium storing program 
instructions that are executable by a computing device to product, comprising : 

a computer program processable by an information handling system for causing the 
information handling system to make a determination[[e]] whether a that a first resource received 
from a first computer network is likely misrepresented as being from a trusted resource coupled 
to the first within a global computer network^-aftd 

apparatus from which the computer program product is accessible from th e comput e r 
r e adabl e m e dium . 



62. (Currently Amended) The computer -readable memory medium program product of claim 

61, wherein the first resource is a web page, and is likely misrepresented by [[a]] content of [[a]] 
the web page. 

63 . (Currently Amended) The compute r-readable memory medium program product of claim 

62, wherein the content is an information entry field embedded in the web page. 

64. (Currently Amended) The compute r-readable memory medium program product of claim 
62, wherein the web page is a first web page, and wherein the content is an address of a second 
web page. 

65. (Currently Amended) The computer -readable memory medium program product of claim 
64, wherein the address is a hyperlink embedded in the first web page. 
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66. (Currently Amended) The computer -readable memory medium program product of claim 
61, wherein the first resource is an electronic message, and is likely misrepresented by [[a]] 
content of [[an]] the electronic message. 

67. (Currently Amended) The computer -readable memory medium program product of claim 
66, wherein the content is an information entry field embedded in the electronic message. 

68. (Currently Amended) The computer -readable memory medium program product of claim 
66, wherein the content is an address of a web page. 

69. (Currently Amended) The compute r-readable memory medium program product of claim 
68, wherein the address is a hyperlink embedded in the electronic message. 

70. (Currently Amended) The compute r-readable memory medium program product of claim 
66, wherein the content is a source address of the electronic message. 

7 1 . (Currently Amended) The computer -readable memory medium program product of claim 
61, wherein the first resource is a web page. 

72. (Currently Amended) The computer -readable memory medium program product of claim 

7 1 , wherein making said determination includes the computer program is procossablo by the 
information handling system for causing the information handling system to dotormino whether 
the resource is likely misrepresented as a trusted resource by at least : 

analyzing an address of the web page. 

73. (Currently Amended) The computer -readable memory medium program product of claim 

72, wherein the computer program is proccssablc by the information handling system for causing 
the information handling system to analyzing[[e]] an address of the web page includes by-at 

in response to determining that the address points to a known trusted web page, 
determining making a determination that the web page is not misrepresented as being from a 
trusted resource. 
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74. (Currently Amended) The computer -readable memory medium program product of claim 
72, wherein the computer program is processable by the information handling system for causing 
the information handling system to analyzing[[e]] an address of the web page includes by at 

in response to determining that the address points to a known mistrusted web page, 
determining making a determination that the web page is likely misrepresented as being from a 
trusted resource. 

75. (Currently Amended) The compute r-readable memory medium program product of claim 
7 1 , wherein making said determination includes the computer program is processable by the 
information, handling system for causing the information handling system to determine whether 
the resource is likely misrepresented as a trusted resource by at least : 

analyzing [[a]] content of the web page. 

76. (Currently Amended) The computer -readable memory medium program product of claim 

75, wherein the comput e r program is processable by the information handling system for causing 
the information handling system to analyzing[|c a]] content of the web page includes by at least : 

in response to determining that the content includes [[a]] predetermined content, making 
a determination determining that the web page is likely misrepresented as being from a trusted 
resource. 

77. (Currently Amended) The compute r-readable memory medium program product of claim 

76, wherein the predetermined content is a request for financial information. 

78. (Currently Amended) The compute r-readable memory medium program product of claim 

77, wherein the financial information is information about a bank account. 

79. (Currently Amended) The compute r-readable memory medium program product of claim 
77, wherein the financial information is information about a credit card account. 

80. (Currently Amended) The compute r-readable memory medium program product of claim 
7 1 , wherein making said determination includes the computer program is processable by the 
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information handling system for causing the information handling system to determine whether 
the resource is likely misrepresented as a trusted resource by at least : 

analyzing a layout of the web page. 

8 1 . (Currently Amended) The computer -readable memory medium program product of claim 
80, wherein the computer program is processable by the information handling system for causing 
the information handling system to analyzing[[e]] a layout of the web page includes by at least : 

in response to determining that the layout is similar to a layout of a known mistrusted 
web page, making a determination determining that the web page is likely misrepresented as 
being from a trusted resource. 

82. (Currently Amended) The compute r-readable memory medium program product of claim 
7 1 , wherein making said determination includes the computer program is processable by the 
information handling system for causing the information handling system to determine whether 
th e r e sourc e is likely misrepresented as a trusted resource by at least : 

analyzing information associated with the web page. 

83. (Currently Amended) The computer -readable memory medium program product of claim 
82, wherein the web page is part of a website, and wherein the computer program is processable 
by the information handling system for causing the information handling system to 
analyzing[[e]] information associated with the web page includes by at least : 

determining an age of the website. 

84. (Currently Amended) The compute r-readable memory medium program product of claim 
82, wherein the web page is part of a website, and wherein the computer program is processable 
by the information handling system for causing the information handling system to 
analyzing[[e]] information associated with the web page includes by at least : 

determining a size of the website. 

85. (Currently Amended) The compute r-readable memory medium program product of claim 
82, wherein the web page is part of a website, and wherein the computer program is processable 
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by the information handling system for causing the information handling system to 
analyzing[[e]] information associated with the web page includes by at least : 

determining a number of hyperlinks to the website by a known trusted resources. 

86. (Currently Amended) The computer -readable memory medium program product of claim 
7 1 , wherein making said determination the computer program is processable by the information 
handling system for causing the information handling system to determine whether the resource 
is likely misrepresented as a trusted resource includes by at least : 

outputting a signal to a computing system that hosts the web page, and analyzing the 
computing system's response thereto. 

87. (Currently Amended) The compute r-readable memory medium program product of claim 
7 1 , wherein making said determination the computer program is processable by the information 
handling system for causing the information handling system to determine whether the resource 
is lik e ly misr e pr e s e nt e d as a trust e d r e source includes by at least : 

performing at least two of the following first set of operations: [[-]] 

analyzing an address of the web page; 

analyzing a- content of the web page; 

analyzing a layout of the web page; 

analyzing information associated with the web page; and 

outputting information to a computing system hosting the web page and analyzing 
the web page's computing system's response thereto; and 

in response to the performed first set of operations, determining a score indicative of the 
likelihood that whether the first resource is likely misrepresented as being from a trusted 
resource. 

88. (Currently Amended) The compute r-readable memory medium program product of claim 
87, wherein making said determination includes the computer program is processable by the 
information handling system for causing the information handling system to determine whether 
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performing at least three of the first 



set of operations. 

89. (Currently Amended) The compute r-readable memory medium program product of claim 
87, wherein making said determination includes the computer program is procossablo by the 
information handling system for causing the information handling system to determine whether 
the resource is likely misrepresented as a trusted resource by performing at least four of the first 
set of operations. 

90. (Currently Amended) The computer -readable memory medium program product of claim 
87, wherein making said determination includes the computer program is processable by the 
information handling system for causing the information handling system to determine whether 
the resource is likely misrepresented as a trusted resource by performing at least five of the first 
set of operations. 

91-126. (Canceled.) 

127. (New) The method of claim 1, wherein said determination is whether the first resource is 
from a trusted or untrusted source. 

128. (New) The method of claim 1, wherein said determination is whether the first resource is 
from a trusted source, an untrusted source, or whether the source of the first resource is 
undetermined. 

129. (New) A computer-readable memory medium storing program instructions that are 
executable on an information handling system to: 

categorize data received via an external network interface of the information handling 
system as to the likelihood of the received data spoofing its origin. 

130. (New) The computer-readable memory medium of claim 129, wherein the received data 
is a web page or an electronic message. 

131. (New) The computer-readable memory medium of claim 129, wherein the received data 
is an e-mail message, and wherein the data is received via the Internet. 
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132. (New) The computer-readable memory medium of claim 129, wherein the program 
instructions are executable to categorize the received data as spoofing its origin or not spoofing 
its origin. 

133. (New) The computer-readable memory medium of claim 129, wherein the program 
instructions are executable to categorize the received data as spoofing its origin, not spoofing its 
origin, or indeterminate as to whether the received data is spoofing its origin. 

134. (New) A computer-readable memory medium storing program instructions that are 
executable on an information handling system to: 

receive data from an external network coupled to the information handling system; 

analyze the received data to make a determination whether the received data indicates 
that it is from a first source coupled to the external network, but is actually from a second source 
coupled to the external network. 

135. (New) The computer-readable memory medium of claim 134, wherein the received data 
includes information indicating that it is from a source trusted by a user of the information 
handling system. 

136. (New) The computer-readable memory medium of claim 135, wherein the received data 
is intended to cause the user to supply confidential information to a source other than the trusted 
source. 

137. (New) The computer-readable memory medium of claim 136, wherein the confidential 
information is financial information of the user. 

138. (New) The computer-readable memory medium of claim 136, wherein the confidential 
information is login information of the user. 

139. (New) A method, comprising : 

receiving data at a first computing device via a wide-area network, wherein the data 
includes information indicating that the origin of the received data is a first source that is known 
and trusted by a user of the first computing device; 
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analyzing the received data to determine whether the origin of the received data is the 
first source. 

140. (New) The method of claim 139, wherein the received data is a web page or a message. 

141 . (New) The method of claim 139, wherein said analyzing includes determining whether 
the information contained within the received data is associated with the first source, and 
wherein the information includes addresses, content, an information layout. 

142. (New) The method of claim 139, wherein the received data solicits confidential 
information from the user of the first computing device. 

143. (New) The method of claim 139, wherein said analyzing includes generating a score 
indicative of the likelihood that origin of the received data is the first source. 

144. (New) A computer-readable memory medium storing program instructions that are 
executable on a first computing device to: 

analyze a first web page received by the first computing device, wherein the first web 
page includes information indicating that the first web page originates from a first website; 

make a determination of the likelihood that the first web page is misrepresenting that it 
originates from the first website. 

145. (New) The computer-readable memory medium of claim 144, wherein the first web page 
includes information indicating that it is from a website of a financial institution associated with 
a first user of the first computing device. 

146. (New) The computer-readable memory medium of claim 144, wherein the first web page 
includes fields for accepting confidential information of a first user of the first computing device. 

147. (New) The computer-readable memory medium of claim 146, wherein the confidential 
information includes financial information. 

148. (New) The computer-readable memory medium of claim 146, wherein the confidential 
information includes logon information. 
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149. (New) A computer-readable memory medium storing program instructions that are 
executable on a first computing device to: 

receive an electronic message that includes information indicating the electronic message 
originates from a first source; 

make a determination of the likelihood that the electronic message misrepresents that it 
originates from the first source. 

150. (New) The computer-readable memory medium of claim 149, wherein the information 
includes one or more links to a website other than a website associated with the first source. 

151. (New) The computer-readable memory medium of claim 149, wherein the electronic 
messages solicits the submission of confidential information from a user of the first computing 
device. 

1 52. (New) The computer-readable memory medium of claim 151, wherein the layout of the 
electronic message differs from messages originating from the first source. 
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